Section 7 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Clauses (c), (d) and (e) of section 7 deal with processing that flows from law or from the State's functions. Clause (c) covers State functions under law and the interest of sovereignty, integrity and security. Clause (d) covers disclosure duties to the State. Clause (e) covers compliance with judgments, decrees and orders, including certain foreign orders on civil or contractual claims. If an order or notice reaches you, a legal consultation can help you read the basis for disclosure.
Without a consent request, personal data may be processed (c) by the State or its instrumentalities to perform a function under any law in force in India, or in the interest of sovereignty and integrity of India or security of the State; (d) to fulfil any legal obligation to disclose information to the State, in line with the disclosure provisions of that other law; and (e) to comply with any judgment, decree or order under Indian law, or a foreign judgment or order on claims of a contractual or civil nature.
Clauses (c) to (e) at a glance
| Clause | Use | Who relies on it | Limits in the text |
|---|---|---|---|
| 7(c) | Performance of any function under any law in force in India, or in the interest of sovereignty and integrity of India or security of the State | The State or any of its instrumentalities | Only the State and its instrumentalities |
| 7(d) | Fulfilling any obligation under any law in force in India on any person to disclose any information to the State or its instrumentalities | Any person bound by the disclosure duty | Processing must accord with the disclosure provisions in the other law |
| 7(e) | Compliance with any judgment, decree or order under any law in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law in force outside India | Any Data Fiduciary | Foreign orders are limited to contractual or civil claims |
Clause (c): State functions and security
Clause (c) names "the State or any of its instrumentalities". It covers "the performance ... of any function under any law for the time being in force in India" and processing "in the interest of sovereignty and integrity of India or security of the State". Two points stand out.
- The user is the State. Clause (c) cannot be used by a private business just because its activity is useful to the State. Section 2(zb) draws "State" from article 12 of the Constitution.
- Two limbs, joined by "or". One is functional: a function under an Indian law. The other is protective: sovereignty, integrity and security. The text does not say that the security limb is limited by the functional limb.
Clause (c) is separate from the wider exemptions in section 17. Section 17(2)(a) lets the Central Government notify an instrumentality of the State to be outside the Act altogether on listed grounds. Clause (c) is narrower: it is a legitimate use, so the rest of the Act continues to apply, including the duties in section 8, unless section 17 removes them. See the articles on section 17(2) and section 17(4) and (5).
Clause (d): disclosure duties to the State
Clause (d) applies to "any person" who is under "any obligation under any law for the time being in force in India ... to disclose any information to the State or any of its instrumentalities". The processing must be "in accordance with the provisions regarding disclosure of such information in any other law for the time being in force".
So this clause does not create a duty to disclose. It recognises a duty that another law creates, and it confirms that complying does not require consent under this Act. The limit is built in: the processing must follow the other law's own disclosure provisions. A business that hands over more than the other law requires, or to a person that the other law does not name, steps outside the clause.
Practical uses include employers and banks that must furnish information to tax, labour or regulatory authorities under the statutes that govern them. The Act does not list which laws. Identify the statute and the provision that requires the disclosure, and record it.
Clause (e): judgments, decrees and orders
Clause (e) allows processing "for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India".
There is a clear asymmetry.
| Source of the order | What is covered |
|---|---|
| Under Indian law | Any judgment, decree or order |
| Under foreign law | Only a judgment or order relating to claims of a contractual or civil nature |
Foreign criminal or regulatory orders are not within clause (e) on its text. A company that receives a foreign order must identify whether it is a claim of a contractual or civil nature. The clause says nothing about enforceability in India; it only says that complying with such an order is a legitimate use for processing. Whether a foreign order is enforceable here is a separate legal question.
Clause (e) and litigation
Do not confuse clause (e) with section 17(1)(a), which exempts processing necessary for enforcing any legal right or claim from Chapter II (except sections 8(1) and 8(5)), Chapter III and section 16. Clause (e) is about complying with an existing judgment, decree or order; section 17(1)(a) is about enforcing a right or claim. See the article on section 17(1)(a) to (c).
What these clauses do not do
- They do not say that the Data Fiduciary is relieved from section 8(5), security safeguards, or section 8(6), breach intimation. Section 8 still applies to legitimate uses unless section 17 removes it.
- They do not permit sharing data beyond what the law, judgment or order requires.
- They do not define "function", so read the statute that assigns the function.
Practical examples
Example 1: tax authority request. A company receives a notice under a tax law requiring it to furnish information. It may process and disclose the information under clause (d), following the provisions of that law on disclosure.
Example 2: a court decree. A bank is directed by a court order to freeze an account and produce records. It may process the data needed to comply under clause (e).
Example 3: a foreign money decree. A foreign court issues a judgment in a commercial contract claim against an Indian company. Processing data to comply falls within the second limb of clause (e). A foreign regulatory order of a non-civil nature is not covered on the text.
Common mistakes
- A private business relying on clause (c), which is for the State.
- Disclosing more than the other law requires under clause (d).
- Treating every foreign order as within clause (e). Only contractual or civil claims qualify.
- Assuming section 8 duties disappear.
Need help with disclosure requests and orders?
If you receive a regulator's notice, a court order or a foreign judgment that calls for personal data, it is worth checking the legal basis before you respond. Our legal consultation service can help you read the order and the provisions that support disclosure.
Key takeaways
- Clause (c) is for the State and its instrumentalities: functions under law, and sovereignty, integrity and security.
- Clause (d) supports disclosure that another law requires, within that law's own disclosure provisions.
- Clause (e) covers compliance with Indian judgments, decrees and orders and foreign civil or contractual orders.
- These legitimate uses do not remove the section 8 duties.
- Identify the statute or order relied upon and keep a record.
Read next
- Section 7 of the DPDP Act, 2023: voluntary provision and State benefits
- Section 7 of the DPDP Act, 2023: medical emergency, disaster and employment
- Section 17 of the DPDP Act, 2023: legal claims, courts and offences
- DPDP Act key obligations for businesses in India
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.